CVE-2026-97468

An authentication bypass flaw of Important severity (CVSS 7.4) was found in the Apache CXF STSTokenValidator and Security Token Service (STS) components as shipped in Red Hat middleware products, including Red Hat JBoss Fuse 7, JBoss EAP 8, and the Red Hat build of Apache Camel (both the Camel Quarkus and Camel for Spring Boot distributions). Apache CXF cached validated security tokens under a weak, non-cryptographic 32-bit hash (Java Arrays.hashCode/hashCode()) and treated a cache hit as proof that the presented token had already been validated. A remote, unauthenticated attacker could craft a security token, for example a UsernameToken or a self-signed SAML Assertion, whose hash collides with a cached entry; the crafted token would then be accepted without password validation, signature trust verification, or a call to the STS, letting the attacker authenticate as another user and, through STS token validation or renewal, obtain STS-signed tokens for that identity. The Red Hat severity (IMPORTANT, CVSS 7.4, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) is lower than the upstream CISA score (9.1, CRITICAL) because successful exploitation requires that a valid victim token is actively present in the cache and that the attacker craft a 32-bit hash collision against that entry within its lifetime, a condition the upstream rating does not account for. Fixes are being pursued for the affected products. JBoss EAP 7.4 contains the vulnerable component but its affected streams are out of support scope. EAP XP 6 was determined not affected because the vulnerable component is not present. For Red Hat Single Sign-On 7.6, the issue is tracked as delegated and a fix will not be pursued.